cve-2026-87902-poc

CVE-2026-87902 — WordPress Core: unauthenticated path traversal in page-template resolution Unauthenticated local PHP file inclusion in WordPress Core via a double-encoded pagename value — and, under specific deployment conditions, PHP code execution with the web-server account's privileges...